A `Product` index has a `status` field with no explicit mapping. Dynamic mapping gave it `text` (with a `keyword` sub-field, as it does for every string). A query `{ "term": { "status": "PAID" } }` returns nothing, even though documents with `status: "PAID"` clearly exist. Why, and what's the fix?

A text field is analysed at index time — split into terms and lowercased — so "PAID" was indexed as the term paid, not PAID. A term query is not analysed at all: it looks for the exact string "PAID" in the index, which was never written there. The fix is to query the keyword sub-field dynamic mapping already created — { "term": { "status.keyword": "PAID" } } — or, better, map status explicitly as keyword from the start, since a status code is never something you want full-text matched or stemmed.